Privacy Policy.

1.Application of this policy

This Policy applies to personal information about individuals collected by Overlander Capital in the course of operating its business, including information collected through the Website, in consulting engagements, in business communications, and through our professional and commercial relationships. The Policy applies regardless of whether information is collected in writing, by phone, electronically or in person.

References to "personal information" have the meaning given in the Privacy Act. References to "sensitive information" have the meaning given in section 6 of the Privacy Act.

2.Personal information we collect

We collect personal information that is reasonably necessary for one or more of our functions and activities. The kinds of personal information we typically collect include:

• Identification and contact information: name, role, company, email, telephone number, business address.
• Engagement information: information about your company, its R&D activities and expenditure, financial statements, payroll summaries, contractor arrangements, technical documentation, grant agreements and any other supporting documents you provide.
• Correspondence: notes, emails, meeting records and other communications between you and Overlander Capital.
• Website information: information you submit through the Discovery Questionnaire and contact forms, including any files you upload.
• Technical information: technical data captured automatically when you interact with the Website (such as IP address, browser type, pages viewed and timestamps). Where this information can identify an individual it is treated as personal information.

3.How we collect it

We collect personal information directly from you when you contact us, submit information through the Website, engage us for consulting services, or otherwise communicate with us. We may also collect personal information from third parties who are authorised by you to provide it (such as your registered tax agent, employer or professional services firms acting on your behalf), and from publicly available sources where relevant to an engagement.

Where personal information is collected indirectly, we take reasonable steps to make individuals aware of the collection consistent with APP 5.

4.Why we collect it

We collect, hold, use and disclose personal information to:

• provide consulting services to clients in connection with the R&D Tax Incentive program;
• assess and respond to enquiries received through the Website;
• prepare and lodge R&D Tax Incentive registrations, ATO R&D schedules and related supporting materials;
• manage our business operations, billing, engagement records and internal administration;
• comply with applicable laws, regulatory obligations and lawful requests from government authorities; and
• communicate with clients, prospects and professional contacts about matters relevant to our services.

5.Sensitive information

We do not generally collect sensitive information within the meaning of the Privacy Act, including information about racial or ethnic origin, political opinions, religious beliefs, membership of professional or trade associations, sexual orientation, criminal records, biometric data or health information.

Where sensitive information is incidentally provided through documents you submit (for example, payroll summaries that include union membership or health-fund deductions, or contractor records that include date-of-birth), we treat it as sensitive information and handle it with additional care, including limited internal access, secure storage and restricted disclosure.

6.Anonymity and pseudonymity

Where it is lawful and practicable, you have the option of not identifying yourself, or of using a pseudonym, when dealing with Overlander Capital. This option is not available in respect of our consulting engagements, which by their nature require identifying client and project information for the preparation of R&D Tax Incentive registrations and related materials, and for the firm to comply with its own record-keeping and legal obligations.

7.Who we share it with

We do not sell personal information. We may share personal information with the following categories of recipient where reasonably necessary for the purposes set out in this Policy and only to the extent permitted by law:

• Tax agents and professional services firms engaged by or on behalf of the client, where required for review, lodgement or ongoing compliance.
• Related entities of Overlander Capital where required for the delivery of the consulting services, on the basis that each related entity is bound by equivalent confidentiality obligations.
• Professional services providers engaged by us (such as IT and cloud service providers, document storage providers and other infrastructure providers), on terms consistent with this Policy.
• DISR, the Australian Taxation Office or other government bodies, where required by law or by the rules of the R&D Tax Incentive program.
• Other third parties where required or authorised by law (for example, in response to a subpoena, court order or lawful regulatory request).

8.Cross-border disclosures

Some of the service providers we use to support our business — including IT infrastructure, document storage, communication and analytics tools — may store data on servers located outside Australia, typically in the United States or European Union.

Where we disclose personal information to overseas recipients, we take reasonable steps to ensure they handle that information consistently with the Australian Privacy Principles, including by selecting reputable providers and entering into contractual arrangements that contain appropriate data-handling obligations. By using the Website or providing personal information to Overlander Capital, you consent to this disclosure on the terms set out in this Policy.

9.How we hold and secure it

Personal information is held in secured electronic systems and, where applicable, in secure physical files. Overlander Capital runs on a Microsoft 365 Business Premium tenant hosted in the Australian region, administered by an external managed cybersecurity and IT provider. Primary file storage sits on SharePoint Online and OneDrive, organised into controlled folders for client work, templates and precedents. Accounting is maintained separately in Xero.

Access is protected by a layered set of controls. Multi-factor authentication is enforced across all accounts. Identity and access management is delivered through Microsoft Entra on a role-based model, with administrative oversight retained by our external provider. Endpoints across Windows, macOS, iOS and Android are centrally managed through Microsoft Intune, with managed endpoint protection and device response. Data is encrypted in transit and at rest. Client and project data are segregated through SharePoint permissions, and access is limited to personnel who require the information to perform their role. Advanced phishing and ransomware protection is provided through Microsoft Defender. SharePoint and OneDrive version history provide point-in-time recovery, and backups and retention are administered by our managed service provider.

Where work is performed in collaboration with our professional services partner, Evolv3 Innovation Pty Ltd, that work sits within a Google Workspace environment under equivalent controls. Access is restricted to authenticated corporate accounts, data is encrypted in transit and at rest, and client material is not used to train Google's foundational models. Free and consumer-tier services are not used for any work involving client information.

Where personal information is no longer required and we are not required by law to retain it, we will take reasonable steps to destroy or de-identify it.

10.Notifiable data breaches

Overlander Capital complies with the Notifiable Data Breaches scheme established under Part IIIC of the Privacy Act. If we become aware of an "eligible data breach" — a breach of personal information likely to result in serious harm to any individual whose information is involved, and where remedial action has not prevented that harm — we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

We maintain internal procedures for assessing, containing and remediating any suspected data breach, consistent with OAIC guidance.

11.Use of AI and technology tools

In performing our consulting services, we may use artificial intelligence, machine learning and other technology-enabled tools to assist in the drafting, review, analysis and preparation of documentation and materials. Information submitted through the Website or otherwise provided to us may be processed using such tools as part of preparing responses, drafting and reviewing materials.

We remain responsible for oversight, professional judgment and the security of personal information processed through these tools, and we select tools and providers having regard to that responsibility. We do not knowingly use tools that train their models on confidential client material without our consent.

Overlander Capital's AI capability runs on Claude, accessed through Anthropic's commercial products. Under the commercial terms that apply to that use, business inputs are not used to train Anthropic's foundational models, data is encrypted in transit and at rest, and account activity is contained within corporate identity and administrative boundaries controlled by Overlander Capital. All AI use occurs through authenticated corporate accounts; personal and free-tier accounts are not used for client work.

Claude is covered by independently audited external certifications, including SOC 2 Type I and Type II, ISO/IEC 27001:2022 (information security) and ISO/IEC 42001:2023 (AI management systems).

Our internal automation platform is built with operational guardrails. It is designed to work only from source documents supplied by or agreed with the client, not to fabricate content that is not in those sources. It proposes tracked changes and comments for review rather than overwriting client files, cites the source documents behind its proposals, and passes through defined human review gates before any material progresses to lodgement or to the client. Overlander Capital personnel retain final judgment on every output.

12.Cookies and analytics

The Website may use cookies and similar technologies to support its operation, remember your preferences, and measure usage in aggregate. You can adjust your browser settings to refuse cookies; in some cases parts of the Website may not function as intended if you do.

We use a privacy-respecting analytics tool that aggregates usage data and does not, of itself, identify individual visitors. Aggregated analytics data is used to improve the Website and is not combined with personal information for any other purpose without your consent.

13.Direct marketing

We may from time to time send you information about our services, market updates relevant to the R&D Tax Incentive program, or other communications we believe may be of interest. You can opt out of receiving these communications at any time by using the unsubscribe link in any such email, or by contacting us using the details below.

We do not sell, rent or trade personal information for direct marketing purposes, and we do not use sensitive information for direct marketing without express consent.

14.Access and correction

You may request access to the personal information we hold about you, and may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact us using the details below. We will respond within a reasonable timeframe and there is no charge for making a request, although a reasonable charge may apply for providing access where the request is large or complex. Where we refuse access or correction we will explain why in writing.

15.Complaints

If you believe Overlander Capital has breached the Australian Privacy Principles or this Policy, please contact us using the details below. We will investigate your complaint and respond within a reasonable timeframe (typically 30 days). If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

16.Changes to this policy

We may update this Privacy Policy from time to time. The current version is the version published on this Website, with the date and version indicated at the top of the page. Where a change materially affects how we handle personal information, we will take reasonable steps to notify clients and other affected individuals. Your continued use of the Website or our services after any change constitutes acceptance of the updated Policy.

17.Contact

If you have questions about this Privacy Policy, the personal information we hold about you, or how Overlander Capital handles personal information generally, please contact us:

Overlander Capital Advisory Pty Ltd (ACN 699 413 888)
Attention: Privacy Officer
278 Barker Road, Subiaco WA 6008, Australia
Email: admin@overlandercapital.com